diff --git a/acceptance/bundle/resources/secrets/validate-secret-is-string/databricks.yml b/acceptance/bundle/resources/secrets/validate-secret-is-string/databricks.yml
new file mode 100644
index 00000000000..c312e959fbc
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/validate-secret-is-string/databricks.yml
@@ -0,0 +1,13 @@
+bundle:
+  name: test-bundle
+
+resources:
+  secrets:
+    secret1:
+      catalog_name: main
+      schema_name: default
+      name: test_secret
+      value:
+        - hello
+        - world
+      comment: "This should fail validation"
diff --git a/acceptance/bundle/resources/secrets/validate-secret-is-string/out.test.toml b/acceptance/bundle/resources/secrets/validate-secret-is-string/out.test.toml
new file mode 100644
index 00000000000..0938e678987
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/validate-secret-is-string/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/resources/secrets/validate-secret-is-string/output.txt b/acceptance/bundle/resources/secrets/validate-secret-is-string/output.txt
new file mode 100644
index 00000000000..07cfd2978b5
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/validate-secret-is-string/output.txt
@@ -0,0 +1,14 @@
+
+=== Deploy should fail due to plain text secret value
+>>> [CLI] bundle deploy
+Warning: expected string, found sequence
+  at resources.secrets.secret1.value
+  in databricks.yml:11:9
+
+Error: Secret value must be a string
+  at resources.secrets.secret1.value
+
+The secret value for "secret1" must be a string.
+
+
+Exit code: 1
diff --git a/acceptance/bundle/resources/secrets/validate-secret-is-string/script b/acceptance/bundle/resources/secrets/validate-secret-is-string/script
new file mode 100755
index 00000000000..cc724cd5692
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/validate-secret-is-string/script
@@ -0,0 +1,2 @@
+title "Deploy should fail due to plain text secret value"
+trace $CLI bundle deploy
diff --git a/acceptance/bundle/resources/secrets/validate-secret-is-string/test.toml b/acceptance/bundle/resources/secrets/validate-secret-is-string/test.toml
new file mode 100644
index 00000000000..dcbf079204f
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/validate-secret-is-string/test.toml
@@ -0,0 +1,7 @@
+Cloud = false
+RecordRequests = false
+
+Ignore = [".databricks"]
+
+[EnvMatrix]
+DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/bundle/config/mutator/validate_secret_value_is_variable.go b/bundle/config/mutator/validate_secret_value_is_variable.go
index b077d9430e5..39b7822168a 100644
--- a/bundle/config/mutator/validate_secret_value_is_variable.go
+++ b/bundle/config/mutator/validate_secret_value_is_variable.go
@@ -28,6 +28,13 @@ func (v *validateSecretValueIsVariable) Apply(ctx context.Context, b *bundle.Bun
 		p := dyn.NewPath(dyn.Key("resources"), dyn.Key("secrets"), dyn.Key(key), dyn.Key("value"))
 		val, err := dyn.GetByPath(b.Config.Value(), p)
 		if dyn.IsNoSuchKeyError(err) {
+			diags = append(diags, diag.Diagnostic{
+				Severity:  diag.Error,
+				Summary:   "Secret value must be a string",
+				Detail:    fmt.Sprintf(`The secret value for "%s" must be a string.`, key),
+				Locations: val.Locations(),
+				Paths:     []dyn.Path{p},
+			})
 			continue
 		}
 		if err != nil {
@@ -36,6 +43,13 @@ func (v *validateSecretValueIsVariable) Apply(ctx context.Context, b *bundle.Bun
 
 		valueStr, ok := val.AsString()
 		if !ok {
+			diags = append(diags, diag.Diagnostic{
+				Severity:  diag.Error,
+				Summary:   "Secret value must be a string",
+				Detail:    fmt.Sprintf(`The secret value for "%s" must be a string.`, key),
+				Locations: val.Locations(),
+				Paths:     []dyn.Path{p},
+			})
 			continue
 		}